Analysis
-
max time kernel
134s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 00:01
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20240221-en
General
-
Target
Setup.exe
-
Size
920KB
-
MD5
82d32f00cafa7c3523a7afa09fd1d215
-
SHA1
5c37e4de2ad8c2a03ba4380f7ac72f385d900b87
-
SHA256
b96a340bb8616e1569c63293a9b19ca57970b8bd94dd82cf3a7270eb625b3461
-
SHA512
717070eb25b34024eecd08c077f05ac51474e54878d3b92c0b681a19a6eeec3c01b8189e43ae1079c6a990584dcea9ce32da2183786d3811bc0fdba411a8e305
-
SSDEEP
24576:6tASL4DCrL58sMaRoNWTn6WHo/gTcxvz+6fH7C:e4DCrL58sVoNyOggzZe
Malware Config
Extracted
lumma
https://employhabragaomlsp.shop/api
https://museumtespaceorsp.shop/api
https://buttockdecarderwiso.shop/api
https://averageaattractiionsl.shop/api
https://femininiespywageg.shop/api
https://stalfbaclcalorieeis.shop/api
https://civilianurinedtsraov.shop/api
https://roomabolishsnifftwk.shop/api
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Setup.exedescription pid process target process PID 4704 set thread context of 2688 4704 Setup.exe RegAsm.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 5092 4704 WerFault.exe Setup.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Setup.exedescription pid process target process PID 4704 wrote to memory of 444 4704 Setup.exe RegAsm.exe PID 4704 wrote to memory of 444 4704 Setup.exe RegAsm.exe PID 4704 wrote to memory of 444 4704 Setup.exe RegAsm.exe PID 4704 wrote to memory of 2720 4704 Setup.exe RegAsm.exe PID 4704 wrote to memory of 2720 4704 Setup.exe RegAsm.exe PID 4704 wrote to memory of 2720 4704 Setup.exe RegAsm.exe PID 4704 wrote to memory of 2688 4704 Setup.exe RegAsm.exe PID 4704 wrote to memory of 2688 4704 Setup.exe RegAsm.exe PID 4704 wrote to memory of 2688 4704 Setup.exe RegAsm.exe PID 4704 wrote to memory of 2688 4704 Setup.exe RegAsm.exe PID 4704 wrote to memory of 2688 4704 Setup.exe RegAsm.exe PID 4704 wrote to memory of 2688 4704 Setup.exe RegAsm.exe PID 4704 wrote to memory of 2688 4704 Setup.exe RegAsm.exe PID 4704 wrote to memory of 2688 4704 Setup.exe RegAsm.exe PID 4704 wrote to memory of 2688 4704 Setup.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:444
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:2720
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:2688
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 6442⤵
- Program crash
PID:5092
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4704 -ip 47041⤵PID:436